SaaS monitoring: What it does and how to catch shadow IT

Why shadow IT spreads undetected

The stance towards shadow IT is often reactive.

You learn about unsanctioned tools when they surface during a security review or when you overhear a casual remark at the coffee kiosk.

By then, the tool may have been embedded in daily workflows for weeks or months.

What happens when SaaS adoption is invisible:

SaaS apps adopted independently don't appear in SSO logs or traditional identity systems, which means you won’t know your actual blast radius if an attack happens.
Independent app adoption accelerates SaaS sprawl. LastPass platform data shows 64.4% of SaaS apps are redundant and 65.5% are abandoned within 30 days. As new tools multiply unchecked across your organization, they create a growing inventory of unmanaged, unused apps that strain your budget.

The answer to these challenges isn’t a better policy but continuous visibility, the kind that doesn’t rely on self-surveys or verbal assurances.

What can LastPass SaaS Monitoring and SaaS Protect do?

To manage shadow IT, you first need visibility.

SaaS Monitoring provides that visibility, while SaaS Protect gives you the controls to govern access.

Together, SaaS Monitoring and SaaS Protect can help you move from discovering shadow IT to actively governing it.

How discovery to governance works

As your team authenticates to SaaS apps in their daily workflows, SaaS Monitoring quietly builds a live inventory before handing off to SaaS Protect.

Step 1: Discover. Every time an employee authenticates to an app, SaaS Monitoring logs it automatically. The discovery is continuous, with the inventory updating as usage changes and access patterns shift. This is the step where you encounter tools you didn’t know existed.

Transparency note: SaaS Monitoring logs SaaS access, not keystrokes or activity outside the scope of the browser extension. If deployed, LastPass recommends informing your employees of its use in enforcing your acceptable use policy.

Step 2: Assess. After SaaS Monitoring surfaces them, review the discovered apps to identify redundant or risky tools that may introduce security or data exposure risks.

“Allow” for safe, approved tools
“Warn” for medium-risk tools
“Block” for high-risk tools

Try LastPass Business Max free Get a demo

What changes when you have a live SaaS inventory

The first and most immediate outcome of activating LastPass SaaS Monitoring is accurate inventory.

Most IT teams discover tools in use they didn’t know existed.

The value isn't simply discovering apps, however.

It's knowing which SaaS apps are in use before they become compliance and security issues.

What’s inside the LastPass 2026 State of AI and SaaS Security Report?

Combined platform data and survey insights reveal a surprising gap between what organizations say about SaaS governance and what’s actually happening on the ground.

Inside the report, you’ll learn:

How many of the apps organizations sign up for quietly go unused, and what that sprawl costs you
Where redundant apps pile up across categories your organization already covers
How often employees log in with credentials exposed in known data breaches, and what that means for your SaaS accounts
How app adoption patterns differ between organizations of different sizes and maturity levels
A data-backed look at where security leaders plan to focus their governance efforts next and the capabilities they’re prioritizing

Why should you trust the findings?

The LastPass 2026 State of AI and SaaS Security Report is built on:

Observed app usage at 15,907 organizations
The login habits of 450,784 users across 20,631 organizations
Insights from 412 IT leaders responsible for security and governance decisions

Frequently asked questions

SaaS Monitoring provides visibility into the SaaS apps accessed in the browser.

SaaS Protect provides risk-tiered controls to secure that access. Together, they provide a cost-effective, practical SaaS governance solution for small to midsized businesses.

SaaS Protect’s “warn” mode provides a warning or pop-up in the browser when employees try to access a risky app.

The employee sees the context, that the tool isn’t aligned with corporate policy, and must acknowledge it before continuing.

“Warn” mode is recommended for medium-risk tools: It creates friction without blocking access but logs that access so you can decide on concrete actions to protect your business. Another SaaS Protect capability, “block” mode, is recommended for high-risk apps.

No additional deployment is required beyond the LastPass browser extension.

Both SaaS Monitoring and SaaS Protect activate through the existing extension.

It can be, particularly if you can’t yet say which SaaS apps your team uses, or how many of them go unused or overlap with tools you already pay for. SaaS Monitoring and SaaS Protect are included in LastPass Business Max, so there’s no separate add-on to buy.

Upgrading to Business Max gives you everything in your current plan plus a live SaaS inventory and the controls to act on it, all through the browser extension your team already uses.

Don't see your questions here? Visit Support Center.

GUIDE

How to see every app with SaaS monitoring

Key stats: What the data shows

Source: The LastPass 2026 State of AI and SaaS Security Report. Insights based on survey responses from 412 IT leaders, login habits from 450,784 users across 20,631 organizations, and app usage at 15,907 organizations.

65.5% of the apps organizations sign up for go unused within 30 days.

64.4% of apps are in a category where the organization already uses at least one other application.

21.2% of employees are logging in with a credential that has appeared in a known data breach.

Why shadow IT spreads undetected

Get the complete insights